In the Linux kernel, the function tap_get_user_xdp() allocates a page fragment for every incoming XDP packet. When a packet is shorter than an Ethernet header or when the socket buffer allocation fails, the function jumps to an error label but does not release the allocated page, creating a memory leak. Each rejected frame leaks one page‑frag chunk, which can accumulate and exhaust kernel memory if many invalid frames are processed. This flaw reflects the CWE‑772 “Missing Release of Resource After Effective Consumption” weakness and can lead to kernel instability or a reboot.

All Linux kernel builds before the commit that introduced the fix are vulnerable. Systems that enable TAP interfaces with XDP support, such as virtual machines, containers, or host‑based services using TAP devices, are affected. The vulnerability is present in any kernel revision that has not incorporated the relevant patch.

An attacker who can send malformed network frames to a TAP device can repeatedly trigger the error paths, each time leaking a page fragment. The attack vector is likely through malicious traffic on a network connected to a TAP interface; this inference comes from the description of frame validation failures. Privilege requirements are not explicitly stated, so it is inferred that local or remote network access to the TAP endpoint is sufficient. The EPSS score is not available, and the flaw is not listed in CISA KEV, but repeated exploitation can deplete kernel memory, raising the risk to moderate or higher for exposed TAP endpoints.